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CLAIMS 



1. An apparatus comprising: 
at least one processor; and 

one or more media including processor-executable instructions that are 
capable of being executed by the at least one processor, the processor-executable 
instructions adapted to direct the apparatus to perform actions comprising: 

monitoring at least one signal characteristic for a plurality of signals 
that relate to a single source address; and 

detecting a wireless interloper if a discrepancy is determined to exist 
with regard to the monitored at least one signal characteristic for the 
plurality of signals. 

2. The apparatus as recited in claim 1, wherein the processor-executable 
instructions are adapted to cause the apparatus to perform further actions 
comprising: 

producing a plurality of communication beams; and 
receiving the plurality of signals via at least one communication 
beam of the plurality of communication beams. 

3. The apparatus as recited in claim 1, wherein the apparatus comprises 
an access station or a remote client. 
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4. The apparatus as recited in claim 3, wherein the apparatus further 
comprises: 

an antenna array having a plurality of antenna elements; and 
a beamformer coupled to the antenna array. 

5. The apparatus as recited in claim 1 3 wherein the monitoring action 
comprises: 

ascertaining the at least one signal characteristic for the 
plurality of signals. 



6. The apparatus as recited in claim 5 5 wherein the ascertaining action 
comprises: 

ascertaining the at least one signal characteristic as 
selected from the group comprising: arrival delay, arrival 
direction, multipath offset, signal frequency, and signal 
strength. 



7. The apparatus as recited in claim 1, wherein the processor-executable 
instructions are adapted to cause the apparatus to perform a further action 
comprising: 

determining if the discrepancy exists with regard to the monitored at 
least one signal characteristic for the plurality of signals. 
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8. The apparatus as recited in claim 7, wherein the determining action 
comprises: 

determining if the monitored at least one signal characteristic 
for a first signal of the plurality of signals fails to be commensurate 
with the monitored at least one signal characteristic for a second 
signal of the plurality of signals. 

The apparatus as recited in claim 7, wherein the determining action 

determining if a bi-modal distribution exists responsive to a 
predetermined threshold with regard to the monitored at least one 
signal characteristic for the plurality of signals. 

10. The apparatus as recited in claim 1, wherein the processor- 
executable instructions- are adapted to cause the apparatus to perform a further 
action comprising: 

if a wireless interloper is detected in the detecting action, countering 
the wireless interloper. 

11. The apparatus as recited in claim 1 5 wherein the monitoring action 
comprises: 

receiving a plurality of packets having the at least one signal 
characteristic, each packet of the plurality of packets including the 
single source address. 



9. 

comprises: 
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12. The apparatus as recited in claim 1, wherein the detecting action 
comprises: 

detecting that two sources exist for the plurality of signals 
that related to the single source address if a discrepancy is 
determined to exist with regard to the monitored at least one signal 
characteristic for the plurality of signals. 

13. One or more processor-accessible media comprising processor- 
executable instructions that, when executed, direct an apparatus to perform actions 
comprising: 

ascertaining at least one signal characteristic for a plurality of signals that 
relate to a single source address; and 

detecting a wireless interloper if a discrepancy is determined to exist with 
regard to the ascertained at least one signal characteristic for the plurality of 
signals that relate to the single source address. 

14. The one or more processor-accessible media as recited in claim 13, 
comprising the processor-executable instructions that, when executed, direct the 
apparatus to perform a further action comprising: 

countering a detected wireless interloper. 
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15. The one or more processor-accessible media as recited in claim 14, 
wherein the action of countering comprises at least one action selected from the 
group comprising: 

providing notification of the detected wireless interloper; 

recording the ascertained at least one signal characteristic for the 
plurality of signals that relate to the single source address; and 

terminating one or more communications that relate to the single 
source address. 

16. The one or more processor-accessible media as recited in claim 13, 
wherein at least a portion of the processor-executable instructions comprise at 
least part of software for a wireless access station. 

17. An access station that is capable of ascertaining at least one signal 
characteristic for a plurality of signals, that is configured to detect a wireless 
interloper with regard to a particular address by analyzing the ascertained at least 
one signal characteristic for the plurality of signals, and that is adapted to counter 
the detected wireless interloper. 

18. The access station as recited in claim 17, wherein the access station 
is further configured to detect a wireless interloper by analyzing the ascertained at 
least one signal characteristic for particular signals of the plurality of signals that 
are associated with the particular address. 
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19. The access station as recited in claim 17, wherein the access station 
is further configured to detect a wireless interloper by determining that a 
discrepancy exists with respect to the ascertained at least one signal characteristic 
for particular signals of the plurality of signals, wherein the particular signals are 
associated with the particular address. 

20. A wireless receiver that is configured to perform actions 
comprising: 

receiving a first packet that includes a particular address and has at least 
one first characteristic; 

receiving a second packet that includes the particular address and has at 
least one second characteristic; 

determining if the at least one first characteristic fails to be commensurate 
with the at least one second characteristic; and 

if so, detecting an interloper with respect to packets with the particular 
address. 

21. The wireless receiver as recited in claim 20, wherein the wireless 
receiver comprises at least one of an access station and a remote client. 

22. The wireless receiver as recited in claim 20, wherein the wireless 
receiver is configured to perform a further action comprising: 

if not, continuing to monitor received packets that include the particular 
address. 
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23. The wireless receiver as recited in claim 20, wherein the at least one 
first characteristic and the at least one second characteristic comprise one or more 
spatial parameters. 

24. The wireless receiver as recited in claim 23 , wherein the one or 
more spatial parameters comprise at least one of an arrival delay, an arrival 
direction, and a multipath offset. 

25. The wireless receiver as recited in claim 20, wherein the at least one 
first characteristic and the at least one second characteristic comprise one or more 
signal characteristics selected from the group comprising: arrival delay, arrival 
direction, multipath offset, signal frequency, and signal strength. 
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26. An apparatus comprising: 
at least one processor; and 

one or more media including processor-executable instructions that are 
capable of being executed by the at least one processor, the processor-executable 
instructions adapted to direct the apparatus to perform actions comprising: 

ascertaining at least one characteristic for a packet having a 
particular address; 

logging the at least one characteristic for the packet in association 
with the particular address; 

determining if a bi-modal distribution exists with regard to the 
particular address; and 

if a bi-modal distribution is determined to exist, detecting an 
interloper with regard to the particular address. 

27. The apparatus as recited in claim 26, wherein the processor- 
executable instructions are adapted to cause the apparatus to perform a further 
action comprising: 

receiving the packet having the particular address via a 
communication beam of a plurality of communication beams. 

28. The apparatus as recited in claim 26, wherein the apparatus 
comprises at least one of an access station and a remote client. 
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29. 

comprises: 



The apparatus as recited in claim 26, wherein the ascertaining action 



ascertaining at least one signal characteristic for the packet 
having the particular address. 



30. The apparatus as recited in claim 26, wherein the ascertaining action 
comprises: 

ascertaining at least one of arrival direction and multipath 
offset for the packet having the particular address. 



31. The apparatus as recited in claim 26, wherein the ascertaining action 
comprises: 

ascertaining the at least one characteristic as selected from the 
group comprising: arrival delay, arrival direction, multipath offset, 
signal frequency, arid signal strength. 



32. The apparatus as recited in claim 26, wherein the ascertaining action 
comprises: 

ascertaining a value for the at least one characteristic for the 
packet having the particular address. 
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33. The apparatus as recited in claim 26, wherein the logging action 
comprises: 

storing the at least one characteristic for the packet at an entry 
in a table, the entry corresponding to the particular address. 

The apparatus as recited in claim 26, wherein the logging action 

increasing a packet tally at an ascertained value of the at least 
one characteristic at an entry corresponding to the particular address. 

35. The apparatus as recited in claim 26 ? wherein: 

the one or more media further includes a table linking assigned addresses to 
signal characteristics; and 

the logging action comprises storing the at least one characteristic for the 
packet at an entry that corresponds to the particular address in the table. 

36. The apparatus as recited in claim 26, wherein the determining action 
comprises: 

determining if a bi-modal distribution exists with regard to 
the particular address for any signal characteristic. 



34. 

comprises: 
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37. 

comprises: 



The apparatus as recited in claim 26, wherein the determining action 



determining if a bi-modal distribution exists with regard to 
the particular address responsive to at least one threshold. 

38. The apparatus as recited in claim 37, wherein the at least one 
threshold comprises a number of packets. 

39. The apparatus as recited in claim 37, wherein the determining action 
further comprises: 

determining if two packet tallies for two different 
values exceed the at least one threshold for the at least one 
characteristic with regard to the particular address. 

40. The apparatus as recited in claim 26, wherein the detecting action 
comprises: 

clearing the bi-modal distribution that exists with regard to 
the particular address; 

determining if the bi-modal distribution is presented again; 

and 

if so, detecting the interloper with regard to the particular 
address based on the re-presentation of the bi-modal distribution. 
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41. The apparatus as recited in claim 26, wherein the processor- 
executable instructions are adapted to cause the apparatus to perform further 
actions comprising: 

determining if another bi-modal distribution exists with regard to the 
particular address; and 

if both the bi-modal distribution and the other bi-modal distribution 
are determined to exist, detecting the interloper with regard to the particular 
address. 

42. The apparatus as recited in claim 26, wherein the processor- 
executable instructions are adapted to cause the apparatus to perform a further 
action comprising: 

applying an aging policy to logged characteristics for packets having 
the particular address. 

43. The apparatus as recited in claim 42, wherein the applying action 
comprises: 

applying an aging policy to logged characteristics for packets 
having the particular address in dependence on a current number of 
logged packets. 
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44. The apparatus as recited in claim 42, wherein the applying action 
comprises: 

applying an aging policy to logged characteristics for packets 
having the particular address by employing a decaying time 
constant. 

45. The apparatus as recited in claim 26, wherein the processor- 
executable instructions are adapted to cause the apparatus to perform a further 
action comprising: 

countering the detected interloper. 

46. The apparatus as recited in claim 45, wherein the countering action 
comprises: 

providing a notification of the detected interloper. 

47. The apparatus as recited in claim 45, wherein the countering action 
comprises: 

recording logged characteristics that are associated with the 
particular address. 

48. The apparatus as recited in claim 45, wherein the countering action 
comprises: 

recording a payload of the packet having the particular 
address. 
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49. The apparatus as recited in claim 45, wherein the countering action 
comprises: 

terminating one or more communications involving packets 
having the particular address. 

50. A wireless apparatus that is configured to perform actions 
comprising: 

receiving a packet having a particular address; 

increasing a tally for a value for at least one characteristic of the received 
packet, the tally associated with the particular address; 

determining if tallies for two different values exceed a predetermined 
threshold, the tallies associated with the particular address; and 

if tallies for two different values are determined to exceed the 
predetermined threshold, detecting a wireless interloper with regard to the 
particular address. 

51. The wireless apparatus as recited in claim 50, wherein the wireless 
apparatus is configured to perform a further action comprising: 

ascertaining the value for the at least one characteristic of the received 

packet. 

52. The wireless apparatus as recited in claim 50, wherein the apparatus 
comprises at least one of an access station and a remote client. 
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53. The wireless apparatus as recited in claim 50, wherein the at least 
one characteristic comprises at least one signal characteristic selected from the 
group comprising: arrival delay, arrival direction, multipath offset, signal 
frequency, and signal strength. 

54. The wireless apparatus as recited in claim 50, further comprising: 

a table having a plurality of entries, each entry of the plurality of entries 
associating an address with one or more characteristics; a particular entry of the 
plurality of entries corresponding to the particular address, wherein the tally for 
the value for the at least one characteristic of the received packet is stored at the 
particular entry. 

55. The wireless apparatus as recited in claim 50, wherein the 
determining action comprises: 

determining if a bi-modal distribution exists with regard to the 
particular address for the at least one characteristic. 

56. The wireless apparatus as recited in claim 50, wherein the 
predetermined threshold comprises a number of packets. 
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57. The wireless apparatus as recited in claim 50, wherein the tally 
represents a plurality of received packets including an oldest received packet of 
the plurality of received packets; and wherein the wireless apparatus is configured 
to perform a further action comprising: 

decreasing the tally if an age of the oldest received packet exceeds a 
predetermined period. 

58. The wireless apparatus as recited in claim 50, wherein the wireless 
apparatus is configured to perform a further action comprising: 

countering the detected wireless interloper. 

59. The wireless apparatus as recited in claim 58, wherein the 
countering action comprises at least one of: 

providing a notification of the detected wireless interloper; 

recording the two different values for the at least one characteristic 
that are associated with the particular address; and 

terminating one or more communications that involve received 
packets having the particular address. 
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60. An arrangement comprising: 

means for monitoring at least one signal characteristic for a plurality of 
signals that relate to a single source address; and 

means for detecting a wireless interloper if a discrepancy is determined to 
exist with regard to the monitored at least one signal characteristic for the plurality 
of signals. 

61. The arrangement as recited in claim 60, further comprising: 
means for producing a plurality of communication beams; and 

means for receiving the plurality of signals via at least one communication 
beam of the plurality of communication beams. 

62. The arrangement as recited in claim 60, wherein the means for 
monitoring comprises: 

means for ascertaining the at least one signal characteristic for the 
plurality of signals. 

63. The arrangement as recited in claim 60, further comprising: 
means for determining if the discrepancy exists with regard to the 

monitored at least one signal characteristic for the plurality of signals. 
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64. The arrangement as recited in claim 63 , wherein the means for 
determining comprises: 

means for determining if the monitored at least one signal 
characteristic for a first signal of the plurality of signals fails to be 
commensurate with the monitored at least one signal characteristic for a 
second signal of the plurality of signals. 

65. The arrangement as recited in claim 63, wherein the means for 
determining comprises: 

means for determining if a bi-modal distribution exists responsive to 
a predetermined threshold with regard to the monitored at least one signal 
characteristic for the plurality of signals. 

66. The arrangement as recited in claim 60, further comprising: 
means for countering a wireless interloper responsive to the means for 

detecting. 

67. The arrangement as recited in claim 60, wherein the means for 
monitoring comprises: 

means for receiving a plurality of packets having the at least one 
signal characteristic, each packet of the plurality of packets including the 
single source address. 
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68. The arrangement as recited in claim 60, wherein the means for 
detecting comprises: 

means for detecting that two sources exist for the plurality of signals 
that relate to the single source address if a discrepancy is determined to 
exist with regard to the monitored at least one signal characteristic for the 
plurality of signals. 

69. A method comprising: 

ascertaining a plurality of respective values for at least one signal 
characteristic for a plurality of respective packets, each packet of the plurality of 
respective packets corresponding to a particular source address; and 

determining if the plurality of respective packets originate from more than 
one source responsive to the plurality of respective values. 

70. The method as recited in claim 69, further comprising: 

if the plurality of respective packets are determined to originate from more 
than one source, 

detecting that a wireless interloper is present with regard to the 
particular source address; and 

countering the detected wireless interloper. 
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71. The method as recited in claim 69, wherein the determining 
comprises: 

determining that a discrepancy exists among the plurality of 
respective values for the at least one signal characteristic for the plurality of 
respective packets. 

72. The method as recited in claim 69, wherein the determining 
comprises: 

determining that a first set of values from the plurality of respective 
values fails to be commensurate with a second set of values from the 
plurality of respective values. 

73. The method as recited in claim 69, wherein the determining 
comprises: 

determining that a first packet tally corresponding to a first bin 
holding at least a portion of the plurality of respective values and a second 
packet tally corresponding to a second bin holding at least a portion of the 
plurality of respective values both equal or exceed a predetermined 
threshold for the at least one signal characteristic. 

74. One or more processor-accessible media comprising processor- 
executable instructions that, when executed, direct an apparatus to perform the 
method as recited in claim 69. 
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75. An apparatus comprising: 

a signal characteristic ascertainer that is capable of ascertaining values for 
at least one signal characteristic for received packets having a particular source 
address; and 

a discrepancy detector that is adapted to detect a discrepancy among the 
ascertained values for the at least one signal characteristic for the received packets 
having the particular source address so as to detect a wireless interloper with 
regard to the particular source address. 

76. The apparatus as recited in claim 75, further comprising: 

a table having a plurality of entries, each entry of the plurality of entries 
corresponding to a source address and associating values for the at least one signal 
characteristic therewith; the associated values ascertained from received packets 
having the corresponding source address. 

77. The apparatus as recited in claim 76, wherein the table includes a 
particular entry that corresponds to the particular source address, the particular 
entry associating the ascertained values for the at least one signal characteristic for 
the received packets with the corresponding particular source address. 
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78. The apparatus as recited in claim 75, further comprising: 
an antenna array; 

a beamformer coupled to the antenna array; and 

one or more radio frequency signal processors coupled to the beamformer; 

wherein the received packets are provided to the signal characteristic 
ascertainer via the antenna array, the beamformer, and the one or more radio 
frequency signal processors. 

79. The apparatus as recited in claim 75, wherein the discrepancy 
detector is configured to implement at least one countermeasure against the 
detected wireless interloper. 

80. The apparatus as recited in claim 79, wherein the at least one 
countermeasure comprises at least one of notification, recordation, and 
communication termination. 
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